Privacy Policy

Last updated 5 November 2026

1. What we collect

To issue a dated entry ticket we need:

• Contact details — first name, last name, email address and phone number (with country dial code).
• Billing address — address, city, state/province where applicable, postal code and country.
• Booking details — ticket types, quantities, visit date and time slot.
• Payment data — cardholder name, card number, expiry and CVV. This is the only sensitive set, and it is encrypted in your browser before it is sent.

We also record technical data generated automatically: IP address, user agent, referring page and timestamps, used for fraud prevention and to keep the service working.

2. How payment data is protected

• Your browser generates a one-time AES-256-GCM key, encrypts the whole order payload, and wraps that key with an RSA-2048 public key using RSA-OAEP with SHA-256.
• Only the encrypted envelope is transmitted, over TLS 1.3.
• Decryption happens in the payment backend. We never log or store your full card number or CVV in readable form.

3. Why we use your data

• To create, confirm and deliver your e-ticket.
• To process the payment and prevent fraudulent transactions.
• To handle cancellations, date changes and refunds.
• To answer your support requests.
• To meet accounting and tax obligations.

We do not sell your personal data, and we do not use it for unrelated advertising.

4. Who we share it with

• Payment processor / acquirer — to authorise the transaction.
• Ticket supplier — the data strictly needed to issue your entry ticket.
• Infrastructure providers — hosting, CDN and email delivery, under data-processing agreements.
• Authorities — only where legally required.

5. International transfers

Your data may be processed outside your country of residence, including in Japan and the United States. Where it is, we rely on standard contractual clauses or equivalent safeguards.

6. How long we keep it

Booking and invoicing records are kept for the period required by tax and consumer law. Technical and fraud logs are kept for a shorter period. Payment card data is not retained in readable form after authorisation.

7. Your rights

Depending on where you live, you may request access to your data, correction, deletion, restriction of processing, portability, or object to processing. Use the contact address in your confirmation email, quoting your booking reference. You may also complain to your local data-protection authority.

8. Security

Encryption in transit (TLS 1.3) and at rest, strict content security policy, least-privilege access, and no storage of raw card data. No system is perfectly secure, but we treat your data as if it were our own.

9. Children

The Site is not aimed at children under 16. Bookings for children are made by the accompanying adult, who provides the child’s details for the ticket only.

10. Changes

Any change is published on this page with the date above. Material changes are announced on the Site.